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The security proof of continuous variable quantum key distribution(CV QKD) based on 
two assumptions that the eavesdropper can neither act on the local oscillator nor control 
■ Bob's beam splitter. These assumptions maybe invalid in practice due to some potential 

imperfections of the implementations of the protocol. In [Phys.Rev. A, 84.062308], we 
found that one can control the intensity transmission of the beam splitter by switching 
the wavelength of the input light. In this paper, we revisit the problem of transmitting 
the local oscillator in public channel, and propose a wavelength attack targeting the CV 
QKD systems using heterodyne protocol. Our attack is proved to be feasible and renders 
all final key shared between the legitimate parties insecure even they have monitored the 
intensity. To prevent our attack, a wavelength filter should be added before performing 
the heterodyne detection. 
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1. Introduction 

Quantum key distribution(QKD) enables two distant partners, Alice and Bob, to share 
common secret keys in the present of an eavesdropper, Eve[l]. In theory, the security of QKD 
protocol is solely based on the laws of physics [2, 3]. But in practice, the key components 
of practical QKD system exist imperfections that do not fulfill the assumptions of ideal de- 
vices in these security proofs. In the discrete-variable(DV) QKD(e.g. the BB84 protocol[4]), 
the imperfect devices such as single photon detector, phase modulator, Faraday mirror and 
fiber beam splitter open security loopholes to Eve and lead to various types of side-channel 
attacks [5]- [11]. 

The continuous-variable(CV) QKD[12, 13] suffers the similar problems. In the CV-QKD 
protocols, Alice encodes the key information into the quadratures, X and P, of a weak coherent 
or squeezed state and sends it to Bob. Bob measures one or both quadratures by performing 
homodyne or heterodyne detection(corresponding to the homodyne protocol[12] and hetero- 
dyne protocol[13], respectively) on the signal with a relative strong local oscillator(LO). Fi- 
nally, they perform direct or reverse reconciliation and privacy amplification process to distill 
a common secret key. In practice, it is extremely difficult for Bob to generate the LO with the 
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same initial polarization and phase to the signal. So that Alice prepares both the signal and 
LO, and sent them to Bob in the same fiber channel at the same time to avoid the large drifts 
of the relative polarization and phase [15]. However, this implementation leaves a security 
loophole to Eve. In Ref.[20], the authors proposed a powerful equal-amplitude attack. To 
perform this attack, Eve first intercepts the signal and LO, and measures both of the quadra- 
tures by performing heterodyne detection on them. According to her measurement results, 
she reproduces two weak squeezed states which have the same intensity level to the signal, 
and sends them to Bob. Bob treats these two fake states as signal and LO, and performs 
detections on them as usual. But now the detection is neither homodyne nor heterodyne 
detection, therefore Eve is able to make the extra noise of Bob's measurement much lower 
than the shot noise level. In consequence, the total deviation between Bob's measurement and 
Alice's preparation is lower than the tolerable threshold derived from the theoretical security 
proofs[17, 18], hence Alice and Bob can not discover the presence of Eve. 

In order to prevent this attack without modifying the origin measurement setup, Bob needs 
to monitor the total intensity or the LO intensity [20]. We note that in this attack, Eve is 
assumed to be not able to control the beam splitters of Bob. But in one of our recent study[ll] , 
we found that it is possible for Eve to control the outputs of fiber beam splitters by utilizing 
its wavelength dependent property [21]- [23]. Making use of this loophole, we propose a new 
wavelength attack on the practical CV-QKD system using heterodyne detection protocol[13]. 
By using this attack Eve can in principle achieve all of the secret key without being discovered, 
even if Bob has monitored the total intensity or the LO intensity. 

In the security analysis of CV-QKD protocols, Vmb, Alice's conditional variance of Bob, 
has the similar status as the quantum bit error rate(QBER) in the DV-QKD protocols. To 
prove that the hidden Eve would not be discovered in our attack, our method is proving that 
the upper bound of Va\b under wavelength attack is always lower than the maximum value 
allowed by the secret key rate formula [13, 18]. 

This paper is organized as follows. In section 2, we first rapidly review the heterodyne 
protocol and the wavelength-dependent property of fiber beam splitter, then we propose 
a wavelength attack scheme on an all-fiber CV-QKD system using heterodyne protocol in 
section 3. We prove the feasibility of this wavelength attack in section 4, and finally conclude 
this paper in section 5. 

2. Preliminary 

2.1. Heterodyne protocol 

In the heterodyne protocol, Alice first prepares a displaced vacuum state that will be sent 
to Bob. This is realized by choosing two real numbers Xa and Pa from a Gaussian distribution 
of variance Vo and zero mean. Bob receives this coherent state and simultaneously measures 
both the amplitude and phase quadratures of the state by a heterodyne detection. After 
repeating this process many times, they finally extract a binary secret key by using reverse 
reconciliation algorithm[14]. A typical CV-QKD system using heterodyne protocol can be 
realized by the scheme shown in Fig. 1 [24]. In this scheme, time and polarization multiplexing 
are used so that the signal and LO can be transmitted in the same channel without interfering. 
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Fig. 1. The schematic diagram of heterodyne detection protocol. BSa:l/99 beam splitter; BSb: 
50/50 beam splitter; PM: phase modulator; AM: amplitude modulator; PBS: polarization beam 
splitter; PC: polarization controller. Alice generates coherent light pulses by a 1550nm laser diode, 
then separates them into a weak signal and a strong LO by a 1/99 beam splitter. The signal is 
then modulated randomly following the centered Gaussian distribution in both quadratures, by 
using phase and amplitude modulators. The signal and LO are separated in time and modulated 
into orthogonal polarizations by the PBS before inserting to the channel. 



To perform the heterodyne detection, Bob uses the photo-detector to convert the photons 
into photocurrent i. i and the photon number fi are related by i = qh = qa^a, where a and fifi 
are the annihilation and creation operators of the light state, and q is a suitable constant [27]. 

The consequence of using heterodyne detection is that vacuum noise is introduced into 
Bob's measurements via the 50-50 BS at his station. To show this, let us first describe the 
signal and LO by operators a s and a complex amplitude ctLO respectively. The vacuum noises 
insert to these states from the Bob's BS, and convert the signal and LO to be: 

a s -> a s + N s , ,y 
ollo -> u LO + N LO - 

Where N s and Nlo describe the vacuum noises insert to the signal and LO. Therefore, 
the photocurrents read by the four photo-detectors can be written as follows: 

h = q(a* LO + N{ + at + Nj){a LO + Nlo + a s + N s )/4, 

12 =q(a* LO +Nl -ai-Nl)(a L o+N LO -a s -N s )/4, 

1 3 =q[e-^(al +Nl )+ai+Nt}[e^(a L o+N LO )+a s + N s ]/4, 
U = q[e-^ K + Nlo) -at- N t] [ etf Ko + N LO ) - a s - N s ]/4. 

For simplicity, we assume that a^o is a real number. To derive the quadratures X and P, 
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the difference photo-currents should be measured: 
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where X = and P = 

are the exact quadratures that Bob wants to measure, and 
SX and SP are the quadrature operators of the vacuum noise entering into Bob's BS. The 
vacuum noise introduced by the heterodyne detection can be calculated by: 



N X = ((X B -X) 2 ) = ((N S>X ) 2 ), 
N p = {(P B -P) 2 ) = {(N s , p ) 2 ). 



Following the Heisenberg uncertainty relation ((N s .x) 2 ) ((X s , p ) 2 } > N§ and the property 
of coherent state [28], we can derive that the vacuum noise introduced by the heterodyne 
detection reaches the shot noise level, i.e. N x = N p = N - 

Under the assumption that Eve can not act on LO (it is a basic assumption in the secu- 
rity proofs), only if the excess noise reaches two times of the shot noise level that Eve can 
perform an intercept-resend attack on the channel[16]. It is due to the fact that Eve will 
introduce vacuum noise in the heterodyne detection and suffer the quantum fluctuation when 
she reproduces the signal state in a simple intercept-resend attack. 

2.2. Wavelength- dependent fiber beam splitter 

In Ref.[ll], we studied the wavelength-dependent property of the fiber beam splitter(BS) 
which is made by the fused biconical taper (FBT) technology [21]. The fused biconical taper 
beam splitter(FBT BS) is made by closing two or more bare optical fibers, fusing them in a 
high temperature environment and drawing their two ends at the same time, then a specific 
biconic tapered waveguide structure can be formed in the heating area. The FBT BS is widely 
use in the fiber QKD systems because of the feature of low insertion loss, good directivity 
and low cost. However, intensity transmission of the FBT BS is wavelength-dependent, and 
most types of the FBT BS work only in a limited range of wavelength (limited bandwidth), 

where the intensity transmission of the BS can be defined as T = -j — Ipo ^ tl ; I por ti {Iporti) 

is output light intensity from BS's output port 1 (output port 2). Typical coupling ratio at 
the center wavelength provides optimal performance, but the intensity transmission varies pe- 
riodically with wavelength changes. The relationship between wavelength A and the intensity 
transmission T by using the coupling model is given in Ref.[22, 23]: 



T = F 2 sin 2 {^£^) = T{\). 



(5) 
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where F 2 is the maximal power that is coupled, C is the coupling coefficient, w is the heat 
source width. 

3. Wavelength Attack on a CV QKD system using heterodyne protocol 



Alice 



Fig. 2. The schematic diagram of the wavelength attack scheme. WT-LD: the wavelength tunable 
laser diode; IM: the intensity modulator. The WT-LD and IM are used in producing fake coherent 
states with the specific wavelength and amplitude set by the controller. 

The basic idea of the wavelength attack is shown in Fig. 2. Eve intercepts the coherent 
states sent by Alice. She makes heterodyne measurement of the signal and LO to achieve the 
quadrature values Xe and Pe- After that, Eve generates and re-sends two coherent states: a 
fake signal state \a' s ) and a fake LO state |o^ ). Different from the previous IR attack, these 
two fake states have different wavelengthes, and we denote them as Ai (for \a' s )) and A2(for 
\a' LO )). According to Eq.(5), the performance of Bob's BS is dependent to the wavelength of 
the incoming light. Therefore to the fake signal with wavelength Ai, the density transmission 
of Bob's BS is determined by function T(Ai) which is defined in Eq.(5). Similarly, the density 
transmission of Bob's BS to the fake LO state is determined by T(X 2 ). In other words, Eve 
can control Bob's BS by tuning the wavelength of her fake states. 

With the help of the wavelength tunable laser diodes and intensity modulators, the wave- 
length and amplitude of these fake states are carefully chosen to satisfy the following condi- 
tions: 

KI 2 + Kol 2 = Wo? + \a s l 

a. r 1 =T(Ai)e[o,i] > T a = T(A 2 )e[o,i], 

in. (l-T 1 )(l-2T 1 )\a' LO \ 2 + (l-T 2 )(2T 2 -l)\a' s \ 2 = ^X E \a L o\, W 
iv. Ti(l - 2T 1 )\a' LO \ 2 + T 2 (2T 2 - l)\a' s \ 2 = ^jP E \a LO \, 

where r\ is the channel transmission efficiency, ulo is the amplitude of the original LO, a' s 
and a' LO are the amplitudes of the fake states. 7\ and T 2 are the intensity transmissions of 
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Bob's BS when the fake signal and fake LO income to it. Eve sends these fake sates to Bob. 

Bob gets the quadrature values Xb and Pb by performing heterodyne detection on the 
fake signal and LO. Notice that the fake signal and the fake LO have different wavelengthes, 
no interference is involved in the this detection. Even so, once the conditions in Eq.(7) 
are satisfied, one can find that (details in section 4) the extra noise introduced by Bob's 
measurement is much lower than the shot noise level, therefore the total noise can be kept 
under the alarm threshold. Consequently, Eve safely achieves the key information without 
being discovered. 

We must point out that condition 3 and 4 may not always be satisfied because the am- 
plitudes of a! a and a' LO are constrained by condition 1. However, the fact that \otLo\ 2 3> Ve 
makes sure that the probability of dissatisfying condition 3 or 4 is extremely close to zero. 
For example, assume that Alice chooses |q;lo| 2 = 10 8 Ao and Va = 100Ao[15], conditions 3 
and 4 can always be satisfied if \Xe\, \Pe\ < 10 3 y/No- Notice that the distribution of Xe and 
Pe is a Gaussian distribution with variance of Ve — Va, it is easy to calculate the probability 
of Xe > 10 3 \/7Vo or Pe > 10 3 y/No equals erfc(^=) w 0, where erfc(x) is the error integral. 

The method of monitoring the total intensity is invalid to our attack because the total 
intensity of the fake states arriving to Bob is the same as the case when Eve is absent. 
Moreover, the method of monitoring the LO intensity requires a 1:99 BS to split the LO and 
monitors the minor part. Interestingly, the 1:99 BS is wavelength-dependent if it is also made 
by the FBT technology. Assume that the intensity transmission of the 1:99 BS switches to 
T[ when a' LO incomes, Eve can simply add an extra condition: 

v. (l-T0K o | 2 = 0.01|a LO | 2 , (7) 
to make Bob's monitor record of the LO intensity unchanged. 

4. Feasibility Analysis 

To analyze the feasible of the wavelength attack, we first note that the following assump- 
tions should be satisfied: 

(1) This attack is restricted to an all-fiber coherent-state CV QKD using heterodyne protocol. 

(2) All of Bob's BS have the same wavelength dependent property, i.e. their intensity trans- 
missions are all determined by Eq.(5) with same parameters. This function and the detection 
efficiencies of Bob's detectors are both well known by Eve. 

(3) Eve has the ability to replace the channel with noiseless fiber, and her detectors have high 
efficiency and extreme low dark count rate. 

In the heterodyne protocol, the secret key rate is given by [18]: 

H ~ 1092 n(i+xV)MV+x)+i] ' W 

where \ is the total added noise refers to the input introduced by [18], (V — 1)N is Alice's 
modulation variance. 

Another important parameter in the security proof is Alice's conditional variance of Bob's 
measurement Va\b, which can be thought as the uncertainty in Alice's estimates of Bob's 
quadrature measurement result when reverse reconciliation is in use. In the CV-QKD imple- 
ments, Alice and Bob use Va\b to estimate the shot noise and modulation imperfections [15]. 
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Fig. 3. The relation between the channel transmission efficiency r) and the conditional variance 
Va\b m three situations: (a) the maximum allowable value of V^g in the security analysis, denoted 
as V^jg X ; (b) the value of Va\b m the case of no eavesdropping and the excess noise is negligible, 
denoted as V™^" 10 '; (c) the value of V A \ B in the case of suffering the wavelength attack, denoted 
as Vjffg ■ There are two points should be noticed: (1) V'j^*J } acfc is smaller than towards all 

transmission efficiencies, hence Alice and Bob can not notice the present of Eve. (2) Eve will also 
be discovered if Va|b stays below the shot noise level, because it is impossible when the protocol 
works normally. Therefore Eve should add extra noises to make yj^ acfc equals to y™°™al w j lcn 
t) < 0.9. 



Va\b is defined as: 

Va\b,x = {{Xb ~ \/lX4) 2 ), (n\ 
V a{b , p = ((Pb-^Pa) 2 ). {) 

Because Alice uses coherent state, we have Va\b,x = Va\b,p = V a \b- The relation between 
Va\b an d X is given by [18]: 

V a \b = ,jil± f ±1 N . (10) 

Combining with Eq.(8), we can find that for the sake of deriving positive secret key rate, 

Va\b should be smaller than VJ^g x = ^ 4+T? 4 +?7 — . In other words, if Va\b is smaller than 
this threshold, the heterodyne protocol is considered to be secure. Hence we prove our attack 
feasible by showing that Eve can make Va\b smaller V^fg" when she is performing the wave- 
length attack. The relation between r\ and the maximum allowable value of Va\b is drawn in 
Fig.3(a). 

4.1. VX°B mal in the absent of Eve 

Even in the absent of Eve, Va\b is in the shot noise level because of the vacuum noises 
introduced by Alice's modulation, the channel loss and Bob's measurement. The evolution 
of the quadrature value from a real value X A chosen by Alice to the measurement result Xb 
achieved by Bob is shown in Fig. 4 and listed as follows (we write down the quadrature X only 
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Fig. 4. The evolution of quadratures from (Xa> Pa) to (Xg, Pb)- The upper link between channel 
and Bob drawn in solid line represents the case of no eavesdropping, and the lower one drawn in 
dash line represents the case of Eve performing the wavelength attack. 



since the other quadrature P can be presented in the similar way): 
X A -> X A = X A +N% 



-> x B , = ^x A + yr ^Xjy 

^X B = ^(^jX A + ^T^7 1 X N + N%) ( U > 
= -^(VvXa + y/rjN% + VT^X N + N%), 

where X^ is the amplitude quadrature of the inserted vacuum state due to the channel 
loss [13], and N B is the vacuum noise introduced by the heterodyne detection, as we have 
discussed in section 2. Alice's conditional variance of Bob's measurement in the absent of 
Eve, which we denote as V^°Q™ al , can be calculated as follows: 

ynornal = {{ ± B _ ^X A f) = f^) 2 ) + l -^({X N f) + I((iV£) 2 ) ^ 



= l±2Z iVo + l f Z((l JV )2 ) , 

If the excess noise is negligible(e.g., only 0.06iVo in Ref.[15]), Vat = ((Xn) 2 ) has the minimum 
value of 1, and V2° B ™ al = 1 holds for all 77. Because Alice uses the coherent state, V2° B ™ al = 
V A \bT 1 = V2° B mal = 1 is then established. The relation between 77 and V2° B nal is shown in 
Fig.3(b). 

4.2. V^ B ack in the present of Eve 

When Eve performs the wavelength attack, the evolution of the quadrature X from X A 
to X B is written as follows (the evolution of quadrature P can be written similarly): 



X A -> X A = X A +N% 

(13) 



X E = X A + N% 



-^X B = -L( y /rjX E + X E[B ) 
= -±(^VX A + ^rjN% + ^rjN E + X E{B ), 

where N E is the vacuum noise in Eve's heterodyne detection, X E \ B denotes the deviation 
of X B from y/rjX E - Then we can derive Alice's conditional variance of Bob's measurement, 
which is denoted as V^ B ack , as: 

yauack = (( ^ _ ^X A f) = §((iV 5 ) 2 ) + § {{N E f) + \{{X E]B f) 

= ^N + \{(X m f)= V N + \V m . x , 
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where Ve\b,x can be considered as Eve's conditional variance of Bob's measurement result. 
Similarly, V^ B ack = riN + \V e \b. p - Therefore V^ B ack can be calculated by using the value 
of V e \b- 

To derive Ve\b, let us start from the generation of Eve's fake states. As we have described 
in section 3, Eve generates the fake signal sate |a' s ) and the fake LO state \a' LO ) according to 
her measurement result and sends them to Bob. These fake states can be described by the 
following operators: 

«LO = a LO + Sh LO- 

Where 8a! s and 8a! LO represent the fluctuation of the amplitude caused by the initial vacuum 
noise in the modulation and are constrained by the Heisenberg relation. Therefore we have 

((5X k ) 2 ) = ((5P>) 2 ) = N , where SX k = and 5P k = (k = s, LO). 

Bob performs heterodyne detection on these fake states. According to Eq.(5), Bob's BS 
has different intensity transmissions to a' s and a' LO because of their different wavelengths, 
which is denoted as T\ and T 2 (see condition 2 in Eq.(7)). After passing the first BS cascade, 
a' 8 is separated to ct\ and &2, while a' LO is separated to A3 and A4, which can be derived as 
follows: 

at = VT=T\ {a' LO + N LO ), 
A3 = y/T\{a' LO + Nlo), 

where N^o, N s are the vacuum noise inserted to the fake signal and fake LO respectively at 
Bob's BS. We simplify the symbols by defining 5a' s = Sa' s + N' s and 5&' LO = Sa' LO + N' lo . 

Furthermore, we define the quadratures of 5a' s and 5a' LO by 8X a ^ k = Soik+ 2 5ak and 5P a _ k = 

" fc 2 . afc (k = s, LO), and the variances of these quadratures are easily to be achieved as: 

((5X a , k ) 2 ) = ((SP a , k ) 2 ) = 2N (k = s, LO). (17) 

Finally, after combining by the second BS cascade, the electromagnetic fields arrive at the 
four detectors can be written as: 

bi = VI - T1&1 + VT2&2, 

h = VT1&1 + VI - T 2 &2, j- lg ^ 
h = VI - 2TA3 + VT^, 
64 = VTias + VT^%a 4 . 

And the photocurrents i k = qb\b k , (k=l,2,3,4). 

Bob's quadrature measurement results are then derived from the difference photocurrents, 
using the method in section 2.1: 

i x =i x -i2 = q{b\bi - b\b 2 ) 

= q[(l - T 1 ){l -2T 1 ){\a' L O \ 2 + a'l 5a' L0 + a' L0 Sa'l ) 
+ (1 - T 1 )^ /(l-T2)T2 (a'l a' s + a '[ 5a' s + 5a'l a' s + 5a'l 5a' s ) (19) 
+ (1 - T 1 )V(l-T 2 )T 2 « a ' LO + c/ s *5a' LO + Sa'^a' LO + 5a'^5a' LO ) 
+ (1 - T 2 )(2T 2 - 1)(K| 2 + a';5a' s + c/ B 8c$)\ 



10 Title 



Notice that a' LO and a' s have different frequencies, the terms of a'ja' k , Sa'ja' k and 5a'j5a' k (j, k = 
s, LO; j ^ k) vanish during the measurement. The remaining terms compose the measurement 
result of i r - 



i x = q[(l - Ti)(l - 2T 1 )(\a' LO \ 2 + a'£ 6a' L0 + a' L0 6a'l ) 
+ (1 - T 2 )(2T 2 - 1)(K| 2 + a' s *Sa' s + a' s 5a'J)] 

Similarly, we get the measurement result of i p as: 



(20) 



i p =i 3 —i 4 = q(blb 3 - blb 4 ) 

= qfril - 2T 1 )(|o/ LO | 2 + o£ 66f LO + a' L0 Sa'l ) (21) 
+ T 2 (2T 2 l)(\a> s \ 2 + a' s *Sa' s + a'J&'J)} 

Bob's quadratures measurement results Xb and P E are then calculated as Eq.(3): 

X = ix 

B ~ V2q\a LO \ 

_ (l-T 1 )(l-2T 1 )|a' LO | 2 +(l-T 2 )(2T 2 -l)|a , J 2 

V2\a LO \ 



+ 



(l-T 1 )(l-2T 1 )( a ^ 5&' LO + a ' L0 6a'2^+(l-T 2 )(2T 2 -l)(a';5&' 3 + a ' 3 5&'^) 



_ ^ _ \Z2\olo\ 



(22) 



\Fiq\aLo\ 
= T 1 (l-2T 1 )|a' LO | 2 +T 2 (2T 2 -l)|<| 2 

\/2\a L o\ 

T, ( 1 - 2Tx ) (<o S&' LO +a' LO S&2q)+T 2 (2T 2 - 1) « ^ +< <5a' 3 t ) 
~ l ~ V2\cilo\ 

= V%Pe + ^Pe\b. 

Let and a' s be real, and define SX as the maximum value of 5X ai LO and 5X QjS , and a 
be the minimum value of a' LO and o/ s . Then we get the following inequalities: 

1 <> _ (l-T 1 )(l-2T 1 )« te' LO +a' LO <5al t ) + (l-T 2 )(2T 2 ~l)( a ^a^+ a ^a' 3 t) 



< vWF> 
_ Ti(l-2Ti)(q; 

< v^f • 



J_p = Tl(l-2T 1 Ka^ ^a^ + a ^ <5a , J t )+T 2 (2T 2 -l)( a ^a s+as <5a 3 t ) ( 2 3) 



Therefore, 

Vi5|B„ = ((^|B) 2 > < i^J «!) , (24) 



^| SlP = <(^|b) 2 } < §V|^. 

It is reasonable to set Ve ~ Va = 1007V and |a_Lo| 2 = 10 8 A^ ?7 in the practical implements, 
as in Ref.[15]. In this expression, we can easily achieve that a 2 € (No, 5 x 10 7 rjNo), according 
to the constraint condition 1 in Eq.(7). Therefore Eve can set the value of a to be sufficient 
large in order to make V E \ B sufficient small. For instance, if we make a = 2 x 10 3 , then 
V e \b < 2 x 10~ 3 Ve w \N . Combining with Eq.(14), we then derive that V A \ B < (rj + j^)No- 
Hence we achieve that V^ ck < (r) + j^)N - The relation between 77 and V^ B ack is described 
in Fig. 3(c). 
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We can see from Fig.3 that Vf^ ck is always smaller than V^ B X , and Vf^ ck < V^ mal 
holds when r\ < 0.9. As we have discussed in the beginning of this section, the result V^^ ck < 
V^ B X indicates that Alice and Bob can not notice the present of Eve, therefore our attack 
renders their final key insecure. The feasibility of our attack is proved. 

5. Discussions 

There are several points about the wavelength attack should be remarked: 

(1) As shown in fig.3, V^ B ack < N when r\ < 0.9. It is impossible when the protocol works 
normally, and Eve should add extra noise on her measurement result to increase V^ B ack - 
That means Eve's heterodyne detection does not need to be perfect, and assumption 3 listed 
in section 4 can be compromised. 

(2) It is a little surprising that Iae > Iab- That is because Ve\b is smaller than Va\b, which 
means Eve guesses Bob's measurement result more precisely than Alice does. Therefore Eve 
can make the hole key shared by Alice and Bob insecure. 

(3) To be aware of our attack, Bob should not only add a BS and monitor the intensity[19] 
but also add a wavelength filter before his detection. 

In conclusion, we have proposed a new type of realistic attack, the wavelength attack, for 
continuous- variable QKD system implementing the heterodyne protocol. We have shown that 
when Alice and Bob are unaware of our attack, the final key shared between them is insecure 
and Eve has all information about the key. Different from the powerful equal-amplitude attack 
proposed in Ref.[20], in the wavelength attack Eve has the ability to control Bob's BS and the 
suggestion of testing the total intensity in Ref. [20] can not prevent our attack. Our attack is 
practical for Eve to implement. Therefore, it is important for Alice and Bob to be aware of 
our attack and monitor the intensity of both signal and LO as well. 
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